Violetlabs · Authentication Profile

Violetlabs Authentication

Authentication

Violet Labs exposes two authentication models. The REST Explore API uses an API-key credential passed in an HTTP header. The hosted MCP server (and the broader app.violetlabs.com surface) additionally supports OAuth 2.0 with PKCE and dynamic client registration. API keys are created in Company Settings and may be given an optional expiration date.

Violetlabs secures its APIs with apiKey and oauth2 across 2 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the authorizationCode, clientCredentials, and refreshToken flow(s).

CompanyHardwareEngineeringManufacturingPLMERPData IntegrationRequirements ManagementAerospaceDefenseMCPSystems Engineering
Methods: apiKey, oauth2 Schemes: 2 OAuth flows: authorizationCode, clientCredentials, refreshToken API key in: header

Security Schemes

apiKeyAuth apiKey
· in: header ()
oauth2 oauth2

Source

Authentication Profile

violetlabs-authentication.yml Raw ↑ 
generated: '2026-07-21'
method: searched
source: >-
  https://docs.violetlabs.com/features/api/generate-an-api-key,
  https://docs.violetlabs.com/features/api/endpoints,
  https://docs.violetlabs.com/ai/mcp, and the OAuth/OIDC discovery documents at
  https://app.violetlabs.com/.well-known/openid-configuration and
  /.well-known/oauth-authorization-server.
docs: https://docs.violetlabs.com/features/api/generate-an-api-key
description: >-
  Violet Labs exposes two authentication models. The REST Explore API uses an
  API-key credential passed in an HTTP header. The hosted MCP server (and the
  broader app.violetlabs.com surface) additionally supports OAuth 2.0 with PKCE
  and dynamic client registration. API keys are created in Company Settings and
  may be given an optional expiration date.
summary:
  types: [apiKey, oauth2]
  api_key_in: [header]
  oauth2_flows: [authorizationCode, clientCredentials, refreshToken]
schemes:
- name: apiKeyAuth
  type: apiKey
  in: header
  parameter_name: x-api-key
  description: >-
    Tenant API key created in Company Settings > API Keys, passed on every REST
    request in the x-api-key header (the MCP server accepts the same key as
    X-API-Key). Keys can carry an optional expiration date.
  applies_to: Violet Explore API (POST /api/explore) and API-key MCP clients.
  docs: https://docs.violetlabs.com/features/api/generate-an-api-key
- name: oauth2
  type: oauth2
  description: >-
    OAuth 2.0 authorization server for the hosted MCP server. Users authenticate
    with existing Violet credentials and select a workspace. Supports PKCE
    (S256) and dynamic client registration (RFC 7591).
  authorizationUrl: https://app.violetlabs.com/api/oauth/authorize
  tokenUrl: https://app.violetlabs.com/api/oauth/token
  registrationUrl: https://app.violetlabs.com/api/oauth/register
  grant_types: [authorization_code, refresh_token, client_credentials]
  pkce: S256
  scopes:
    mcp: Access the Violet MCP server for the selected workspace.
  discovery: well-known/violetlabs-openid-configuration.json